OAuth 1.0a

Feature not fully released, documentation in progress...

If you prefer to communicate with the Client Portal Web API without the need to start the CP Gateway (eg. through IBeam), you can use OAuth 1.0a.

This page covers the OAuth 1.0a support in IBind.

• Enabling OAuth 1.0a
• Acquiring the DH Prime
• Using OAuth in IBind
• Init, maintenance and shutdown handler
• Initialize brokerage session
• OAuth with IbkrWsClient for WebSockets
• Examples
• Mention OAuth 2.0

Enabling OAuth 1.0a

Prerequisites

1. An IBKR "Pro" account. There should be no explicit approval needed for basic OAuth access, see notes below.
2. openssl installed.

OAuth 1.0a Setup

1. On your machine run the following commands:

   openssl genrsa -out private_signature.pem 2048
   openssl rsa -in private_signature.pem -outform PEM -pubout -out public_signature.pem
   openssl genrsa -out private_encryption.pem 2048
   openssl rsa -in private_encryption.pem -outform PEM -pubout -out public_encryption.pem
   openssl dhparam -out dhparam.pem 2048
   

2. Visit the IBKR OAuth setup page: https://ndcdyn.interactivebrokers.com/oauth/?loginType=1&action=OAUTH&clt=0#/configuration

3. Log in with your "live" credentials ("paper" credentials won't work)

4. Read the terms and conditions

5. You should now land on the OAuth setup page. At the time of writing this, it looks something like this:

   [screenshot]

6. Fill out as follows:

   1. Consumer Key: A 9 character password you choose (it will convert any alpha characters to upper-case, valid characters are 0-9, A-Z)
   2. Click "Save Key"
   3. Public Signing Key: Upload the public_signature.pem file generated in step 1
   4. Public Encryption Key: Upload the public_encryption.pem file generated in step 1
   5. Diffie-Hellman Parameters: Upload the dhparam.pem file generated in step 1

7. The next step will generate your "Access Token" and "Access Token Secret." - they will not re-appear when you revisit this page.

8. Click "Generate Token". Copy these tokens and store them somewhere safe.

9. Click the toggle switch at the top of the page for "Enable OAuth Access"

Notes

• It can take up to 24 hours for OAuth access to be established. [citation needed]
• As noted on the IBKR Web API documentation:

Much of the Web API's Trading functionality is offered to our clients without any approval process, and the available features are determined primarily by the capabilities of a client's username and account(s). However, many Account Management features are only suitable for clients with certain institutional account structures, and the specifics of their usage will vary according to many factors, such as the Interactive Brokers business entity that carries the client's account structure, or the type of accounts within that structure. Consequently, the majority of the Web API's Account Management functionality is not immediately available for client use without a review and approval by Interactive Brokers. We encourage our institutional clients to contact their Sales Representative for an introduction to this process and the considerations involved.

• If you lose your Access Token and/or Access Token Secret, you can regenerate new ones, but you'll need to update your variables if you do as they will have changed.

Acquiring the DH Prime

Run this Python script to get the "DH Prime" needed for authentication:

import subprocess
import re

# Run OpenSSL command to read DH parameters
result = subprocess.run(["openssl", "dhparam", "-in", "dhparam.pem", "-text"], capture_output=True, text=True)

# Extract the prime (P) value from the OpenSSL output
match = re.search(r"prime:\s*((?:\s*[0-9a-fA-F:]+\s*)+)", result.stdout)

if match:
    # Extract the raw text containing hex values
    prime_hex = match.group(1)

    # Remove spaces, colons, and newlines to get a clean hexadecimal number
    prime_hex_cleaned = re.sub(r"[\s:]", "", prime_hex)

    print(prime_hex_cleaned)  # Final cleaned P value in hexadecimal
else:
    print("No prime (P) value found in the OpenSSL output.")

The result should be a hex string similar to this one:

00f6220dbb372eb7b734ef426c3dc68014ad46d51b9423073f40a5dc747b0d12aac75490534b114186e8dc303c3ec
392e4853e2c340131ba72082ecaaf6bf5777781620a661e95768dfe3d86292408f5d8d3e1f3e90a8096d18e8b8c1c
42e0c074bbff6b9c16983f60559927538be1cd668d79411111def4d2094754cbdc28b82270bff75fedd2ffcf3eef6
538877393587112d33abc449bfb7d4be8effa4460baf65986adc30f3cf2c38e4f633a3052e209bd6eb7680734031a
12a7c982efdb222ed001a9bce460d1f3d32a845b70c3d383c7645a9962028585945f0a8baf0d2d544aafcc400461c
c77ba67ccd2340c22adbcd4709b3b1d723b0fdd9539c95a83